If your business holds personal information about even one Massachusetts resident, 201 CMR 17.00 requires a Written Information Security Program. Here’s who it applies to, why it matters, and a free guide and fillable WISP template to build yours.